add session.user logic with logout option